Saudi PDPL
In force Saudi Arabia · In force Sep 14, 2023 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Sep 14, 2023 | PDPL in force3 years ago | 3 years ago |
| Sep 14, 2024 | One-year grace period ends2 years ago | 2 years ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Saudi Arabia's comprehensive data protection law with implementing regulations and separate transfer regulations: legal bases, data subject rights, breach notification to SDAIA within 72 hours, DPO and registration requirements, and restrictions on transfers outside the Kingdom.
- Who it applies to
- Any processing of personal data of individuals in Saudi Arabia by entities inside or outside the Kingdom, including data of deceased persons.
- Penalties
- Disclosure/publication of sensitive data with intent to harm: up to 2 years' imprisonment and/or fine up to SAR 3 million; other violations: warning or fine up to SAR 5 million, which may be doubled for repeat violations.
- Enforced by
- Saudi Data and Artificial Intelligence Authority (SDAIA) / National Data Management Office
- Official name
- Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, as amended by Royal Decree M/148 of 5/9/1444H)
- Citation
- Royal Decree M/19 (1443H); amended by Royal Decree M/148 (1444H)
- Topics
- privacy, data-residency, breach-notification
Research notes
SDAIA consulted on amendments to the implementing regulations (closed 27 May 2025); adoption not verified.
Related
Israel Privacy Protection Law Amendment 13
Kenya Data Protection Act
Nigeria NDPA
South Africa POPIA
UAE PDPLQuestions about Saudi PDPL
- What are the Saudi PDPL compliance deadlines?
- Sep 14, 2023: PDPL in force. Sep 14, 2024: One-year grace period ends.
- When does Saudi PDPL take effect?
- Saudi PDPL took effect on Sep 14, 2023.
- Who does Saudi PDPL apply to?
- Any processing of personal data of individuals in Saudi Arabia by entities inside or outside the Kingdom, including data of deceased persons.
- What are the penalties under Saudi PDPL?
- Disclosure/publication of sensitive data with intent to harm: up to 2 years' imprisonment and/or fine up to SAR 3 million; other violations: warning or fine up to SAR 5 million, which may be doubled for repeat violations.